Saudi Cybersecurity Frameworks: SAMA and NCA ECC

Saudi organisations are often asked to show their cybersecurity controls against two frameworks at once. SAMA sets rules for the financial sector. The NCA ECC sets national cybersecurity controls. A company may meet one through its regulator and the other through a customer, an investor or a government contract. The work is not two separate compliance projects. It is one control estate, looked at from two directions.

What the Frameworks Ask of Your Systems

Both frameworks ask a company to describe what it protects, how it protects it and how it knows the protection works. The questions reach the systems that run the business, not only the security team.

• Which systems and data are critical?

• Who can reach them, and how is that access approved and reviewed?

• Is data encrypted in transit and at rest?

• Are events logged, monitored and investigated?

• Can the company detect, contain and recover from an incident?

• Are suppliers and their access part of the same control set?

• Is there evidence that each control operated, not just that it exists?

The frameworks are updated from time to time. Check the current version and the timetable that applies to your organisation with the authority and your compliance team. A control that met an old version may not meet the current one.

What Carries the Most Weight

In practice, a small set of controls carries much of the weight. Identity and access is the first. Shared accounts, broad roles and access that is never reviewed are easy to find and hard to defend.

Logging is the second. A company cannot investigate what it did not record. The logs have to cover the systems that matter, reach a place where they are kept, and be readable by the people who respond.

Recovery is the third. A plan that has never been exercised is a document, not a control. A tested restore, a rehearsed response and a named owner turn the plan into evidence.

The fourth is the supplier chain. A critical supplier with weak access controls is part of the company's risk, whether or not the contract says so.

Where Programmes Fail

• The control set is built for the audit and then abandoned.

• Evidence is gathered by hand from screenshots and spreadsheets.

• The asset list is out of date, so the scope is wrong.

• Access reviews are signed without anyone checking the access.

• Logs exist but nobody looks at them.

• Recovery is planned but never tested.

• The same question is answered differently by the security, risk and IT teams.

Each of these is fixable, but only if the control has an owner and a record. A framework mapping is useful when it points to the system that produces the evidence. It is not useful when it is a second copy of the rule book.

What to Do First

Start with the critical systems. List them, name the owner of each one and record the data it holds. Compare that list with the asset inventory the security team already has. The difference is a useful first finding.

Then take one control and make its evidence automatic. Access reviews are a good start, because the data is already in the identity system. A review that produces a dated record, with the reviewer and the decision, is stronger than a policy that says reviews happen.

Repeat for logging, recovery and suppliers. Test one recovery path and keep the result. Run one incident exercise and keep the record. Check that the logs needed for the exercise were actually there. Each test produces evidence that an inspector can check.

Map the results to both frameworks. Where the controls overlap, write the answer once and reference it twice. Where they differ, record the difference and the reason. This keeps the evidence consistent and reduces the work at the next review.

How XSIS Helps

XSIS compares your controls with SAMA and the NCA ECC, shows the gaps and helps you close them. We build the logging, detection, response and recovery that produce the evidence, and we keep that evidence available for your auditors. We do not certify you ourselves. Certification is granted by an accredited body, and we help you prepare for its audit.